Break Me If You Can: Self-Jailbreaking of Aligned LLMs via Lexical Insertion Prompting

arXiv:2601.02670v2 Announce Type: replace Abstract: We introduce self-jailbreaking, a threat model in which an aligned LLM guides its own compromise. Unlike most jailbreak techniques, which often rely on handcrafted prompts or separate attacker models, self-jailbreaking requires no external red-team LLM: the target model's own internal knowledge suffices. We operationalize this via extbf{Self-Jailbreaking via Lexical Insertion Prompting (extsc{SLIP})}, a black-box algorithm that casts jailbreaking as breadth-first tree search over multi-turn dialogues, incrementally inserting missing content words from the attack goal into benign prompts using the target model as its own guide. Evaluations on AdvBench and HarmBench show extsc{SLIP} achieves 90--100% Attack Success Rate (ASR) (avg. 94.7%) across most of the eleven tested models (including GPT-5.1, Claude-Sonnet-4.5, Gemini-2.5-Pro, and DeepSeek-V3), with only {sim}7.9 LLM calls on average, 3--6imes fewer than prior methods. We evaluate existing defenses, show that regex-based approaches are evaded by prompt paraphrasing, and propose the Semantic Drift Monitor (SDM) defense that tracks extsc{SLIP}'s embedding-space trajectory, achieving 76% detection at 5% FPR. However, SDM remains insufficient against adaptive attack strategies, underscoring the need for more advanced defense mechanisms tailored to the self-jailbreaking threat surface. We release our code for reproducibility.

Related

• WASD: Locating Critical Neurons as Sufficient Conditions for Explaining and Controlling LLM Behavior
• Ads in AI Chatbots? An Analysis of How Large Language Models Navigate Conflicts of Interest
• Evaluating LLMs for Demographic-Targeted Social Bias Detection: A Comprehensive Benchmark Study
• When Personalization Tricks Detectors: The Feature-Inversion Trap in Machine-Generated Text Detection

Source: arXiv cs.CL | 2026-04-10